Skip to main content

Linux Kernel EUVDEUVD-2026-39194

| CVE-2026-53243 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-qhcg-6255-c538
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.1 MEDIUM

Local access and low privilege required; C:L added to reflect syzbot's confirmed kernel-infoleak finding, diverging from NVD's C:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 07, 2026 - 22:39 vuln.today
CVSS changed
Jul 07, 2026 - 22:37 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()

There is an bug in which an uninitialized stack variable is used in rseq_exit_user_update() as reported by syzbot:

BUG: KMSAN: kernel-infoleak in rseq_set_ids_get_csaddr include/linux/rseq_entry.h:502 [inline]

The local variable:

struct rseq_ids ids = { .cpu_id = task_cpu(t), .mm_cid = task_mm_cid(t), .node_id = cpu_to_node(ids.cpu_id), };

According to the C standard, the evaluation order of expressions in an initializer list is indeterminately sequenced. The compiler (Clang, in this KMSAN build) evaluates cpu_to_node(ids.cpu_id) *before* ids.cpu_id is initialized with task_cpu(t).

This is fixed by moving the assignment of ids.node_id outside the structure initialization.

AnalysisAI

Uninitialized stack variable use in the Linux kernel's rseq (restartable sequences) subsystem exposes systems to kernel information leak and denial-of-service. The flaw in rseq_exit_user_update() arises from a C standard evaluation-order ambiguity in struct initialization, detected by syzbot's KMSAN (Kernel Memory Sanitizer) as a kernel-infoleak. Affected are Linux 7.0.10 through 7.0.12 and 7.1 release candidates rc3-rc6; exploitation requires local low-privilege access, no public exploit exists, and EPSS is very low at 0.16%.

Technical ContextAI

The vulnerable code resides in the Linux kernel's rseq subsystem (include/linux/rseq_entry.h, function rseq_exit_user_update()). Rseq (restartable sequences) is a kernel feature enabling userspace programs - most notably glibc - to execute short critical sections without kernel intervention, commonly used in performance-sensitive code. The root cause is CWE-908 (Use of Uninitialized Resource): a local struct rseq_ids is initialized as a compound literal where ids.node_id = cpu_to_node(ids.cpu_id) appears in the same initializer list as ids.cpu_id = task_cpu(t). Per the C standard, initializer list expressions are indeterminately sequenced; Clang in an KMSAN build evaluates cpu_to_node(ids.cpu_id) before ids.cpu_id has been assigned, consuming an uninitialized stack slot. The fix moves ids.node_id assignment outside the struct initializer. Affected CPEs: cpe:2.3:o:linux:linux_kernel:* including 7.1:rc3 through 7.1:rc6.

RemediationAI

Upgrade to Linux kernel 7.0.13 or later in the 7.0.x stable series, or apply the upstream fix commits e12d20a63b61aaf9de4772effccf42cc9a003e58 and 6d99479799c69c3cb588fcda19c81d8f61d64ecd available at https://git.kernel.org/stable/. Linux distribution maintainers (RHEL, Debian, Ubuntu, SUSE, Alpine) should be monitored for backported security updates incorporating these commits. As a compensating control while awaiting patched packages, restrict local shell access to multi-tenant systems - since exploitation requires PR:L (local low-privilege user), limiting who can log in or execute code on the host directly constrains the attack surface. Note that rseq cannot be selectively disabled at runtime without impacting glibc-dependent workloads that rely on it for TLS and per-CPU optimizations.

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-39194 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy